f677dd6d25440f1e0441e2bfdf56d1492daecf27495c73d2987527db64a49651

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
Size 2.1MB
Sample260928-ncdmdascpf
SHA256 f677dd6d25440f1e0441e2bfdf56d1492daecf27495c73d2987527db64a49651
MD5 dd9f51a23cc5c7486ebda4ad53c1206c
SHA1 fef0ee2b4edb0575cc9326d8a938b3f6a30f4d6f
SHA512 2f176b6ab27ec8183c1b1b07c9bdeb5e85f6ba05e4973c64d50e1b6bd2a67c7e61006de65519c416b33c19f11c33f2d3938b4d3c0e6b1c26706cf181e360577b
SSDEEP 49152:HI6q9TLz5h91rahA9n/TDbXNKdaslFyKTmCDu+:9aLz5hJfb9saamC
TLSH
T1FDA5F152F682E1FAD80B00B1244FE73A9E31581443158EE7D7E45EB8BE787D1293A71E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
1268	elevation_service.exe
2512	elevation_service.exe
4480	maintenanceservice.exe
4604	OSE.EXE
5532	PerceptionSimulationService.exe
5136	perfhost.exe
3488	ReFsDedupSvc.exe
624	SensorDataService.exe
3188	ssh-agent.exe
4580	AgentService.exe
620	SearchIndexer.exe
3568	maintenanceservice.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
	\??\F:\	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	maintenanceservice.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a5469dfd25f2ba71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2852-0-0x0000000000400000-0x00000000008E3000-memory.dmp	upx
behavioral2/memory/2852-61-0x0000000000400000-0x00000000008E3000-memory.dmp	upx
behavioral2/files/0x000100000000934e-246.dat	upx
behavioral2/files/0x0001000000009953-249.dat	upx
behavioral2/files/0x000100000001b97d-250.dat	upx
behavioral2/memory/2852-248-0x0000000000400000-0x00000000008E3000-memory.dmp	upx
behavioral2/files/0x00010000000093e6-247.dat	upx
behavioral2/memory/3568-299-0x0000000140000000-0x0000000140300000-memory.dmp	upx
behavioral2/files/0x0001000000006215-286.dat	upx
behavioral2/files/0x0001000000009b93-285.dat	upx
behavioral2/files/0x0001000000009cff-284.dat	upx
behavioral2/files/0x0001000000009cd7-283.dat	upx
behavioral2/memory/3568-253-0x0000000140000000-0x0000000140300000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Control Panel\Desktop\FontSmoothing = "2"	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Control Panel\Desktop\FontSmoothingType = "2"	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff315ea53a4fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a9500da83a4fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005ffb16a63a4fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e6f57ce33a4fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1268	elevation_service.exe
1268	elevation_service.exe
1268	elevation_service.exe
1268	elevation_service.exe
1268	elevation_service.exe
1268	elevation_service.exe
1268	elevation_service.exe
2512	elevation_service.exe
2512	elevation_service.exe
2512	elevation_service.exe
2512	elevation_service.exe
2512	elevation_service.exe
2512	elevation_service.exe
2512	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2852	2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
Token: SeAssignPrimaryTokenPrivilege	4580	AgentService.exe
Token: 33	620	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeBackupPrivilege	3488	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3488	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3488	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3488	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3488	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3488	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3488	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3488	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3488	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3488	ReFsDedupSvc.exe
Token: SeDebugPrivilege	1268	elevation_service.exe
Token: SeDebugPrivilege	2512	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 5804	620	SearchIndexer.exe	101
PID 620 wrote to memory of 3544	620	SearchIndexer.exe	102
PID 620 wrote to memory of 2780	620	SearchIndexer.exe	103
PID 620 wrote to memory of 4580	620	SearchIndexer.exe	104
PID 620 wrote to memory of 1276	620	SearchIndexer.exe	106
PID 620 wrote to memory of 4772	620	SearchIndexer.exe	107
PID 620 wrote to memory of 4540	620	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-28_dd9f51a23cc5c7486ebda4ad53c1206c_akira_elex_glassworm.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:2852

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1268

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2512

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4480

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4604

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5532

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5136

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3488

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:624

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3188

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4580

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5804
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3544
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2780
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4580
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1276
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4772
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4540

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
PID:3568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a60ec5acb0862e1f0ff209d07f05170d5da49363152772bbfa62fa4e7d30de3c
MD5 edadc95a1f239c81ccc35adaeedfeb97
SHA1 246de5b117b1d7995973793660c04e01da0b7cdd
SHA512 505fecb934c6abe6ba54a702858d57d9415b832f79813609fa0c9c9fd3dab014a6d2fec808050fccdd7082c9a163701d0b30292d8615c0a6f68cb94c4dbf3847
SSDEEP 49152:Ub+632BuPkFKRrdE6ohmstBhuXjfS4LWxnVA9n/TDbXNKd:O3q6HjBPfb9s
TLSH
T155D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.log

Path C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log
Size 3KB
SHA256 725c795aa8d1787c1f0a6b73316d179386504155c80a804b36b634df3b0c187b
MD5 d411d74ac8a2d40b12e86c7a3737b159
SHA1 8505fd4a5427a435a8ba6eb4092f28f26397509b
SHA512 fc3e3b39fa9be9d2c6fcfcaa108127796bead9ff359844e6781632ec04115dc2c4492c7505c37f9aa8fd0bb720130862550c577612f67192f07eccaf2341a2d3
TLSH
T15F51A467657AB9260406EF84ECF9BD2ABE4D314C54EC51782616AEFC1DB80CCDAC6F10
MD5 SHA1 SHA512 TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 3.0MB
SHA256 a0f4b62104d1b1c769d7f65a90322fa5f0512ba7c73946bfb6b9bf3b29e2cc49
MD5 d312660d79c6b013481ba3633d317746
SHA1 7fdc54082982effd980a2f9cd9be0f392f1f4182
SHA512 97e4888ac0c0024bab18736d454e1ec48a5e269f82d01d52c2d63fcdf9521e471dc6fa7d1d9b3b5eadb92849fa2351768f6e2ce0f2b8e660189ef81517aa0421
SSDEEP 49152:ltcPA9n/TDbXNKd2DslFyKTmCDu+tA9n/TDbXNKd:l3fb9s2DamCGfb9s
TLSH
T112E5236567F808F9CE57423DC8A1C604EA72BC4A5394D7DF03A866251F336C85E3EB86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 44eb6614136048a7a3e39e4d5063b81461942925afe35421e53322d3ec6998a1
MD5 d99484a1b189f9656e9b07b7ee991f67
SHA1 d7150ddb1e65ab13ebdcde9501958f532d5d1337
SHA512 14a90d06502b5a8ad585249542fba10b93ca2b2a40d6fa971489cc391b7b9409ba6752e81362c7093d7261ab59ab71066a05a4a03f74704f2c290e664b12f085
SSDEEP 24576:/XYfDtczA4UeA9n/TM4NZYeNm+9MhUwd:KtcPA9n/TDbXNKd
TLSH
T18785012967E408F9DD67827CC8A28505EA73BC454760E7DF03A49A261F333D85E3EB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 865bd4600cda43753a53bdc4455a4067d9377958fda8562d039e65ef76ae04d2
MD5 9bbf742707d68e1d98b26ea8fa1ce2ef
SHA1 822c218f751adc4061f50d82138e1f29a061d249
SHA512 d0253a64fac10efdbd87cade522d77b1846d95216a1adc794304976462fc34d0c103acafd21675019798896c592d8e8fd9fbd73b8d6235bf24584e60d4a18e1f
SSDEEP 24576:C0Le5ji0hmxYrMRUeA9n/TM4NZYeNm+9MhUwd:CPji0A24A9n/TDbXNKd
TLSH
T18D959E16F6748731D073C0B9C5D2A68EED72348657308ACB4286D77C7E27AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 aa0364ee460205921f46c50bfe297f7a7b316579a972fb97dafc11bef5d56615
MD5 1478b1f6f257ad773a1f65b63bcf9328
SHA1 d262e579f1db33796234a83106e3e01f3cc3a59e
SHA512 60af289441a4d459e0969890ab2bd994e793aa189df679c6ed3cb748a57c8203f115b212f918aa626037f94e44adbebbbbc1d4e1cad7b360bb8d0b9084b42ce8
SSDEEP 24576:9a7/ezSC6vUyD/aqgrvWE6q8wyubUeA9n/TM4NZYeNm+9MhUwd:0/ezSC6vUzPvxHjycA9n/TDbXNKd
TLSH
T11F755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 15818522d40195bef2b1e540aaa20fe4341d0ac9e58922fcdde28f5dad884894
MD5 bb8b3d142e13c02f230d0df1b51206bf
SHA1 deef2fde8e0d81dcd27f322951d45cc890232608
SHA512 9e91f0c21f8d21e46462c627cdf510b0c54a0a422d47dfee8523c3f469ca3c77d5022321098ed12240249ec95845d9c10ac4a1ce7531b44e4e87e447a3fac358
SSDEEP 24576:KVbqPb88hv/l+6kUeA9n/TM4NZYeNm+9MhUwd:KVO88hXl+BA9n/TDbXNKd
TLSH
T166559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 7b537183d57fa4e9e37c7d6ded8ec291cda85b37e402b7073d1f5b6436dcd41a
MD5 095245109fb28b11baaa68e20ab94be7
SHA1 7dd7d883a5d4d1bbbbb42f71c7bcd1259bbd4941
SHA512 d154c3a44584b4f6097d604a619c2caa1821f774ade8dd284d3b8ccbf04a94c29fe061f78f6f29b97292b5c79881cd270d51f758c84e3d1ee0fe1006a49e8cfd
SSDEEP 12288:uHdBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dC:uHdUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1046523824BFC08F1CB8E0A7544AABF0CCEA2FD4DE584879D4719772A5E385C6C95648F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 bb5eb78ed82387110ecfeae54b225123a645033f0e08059c6bb9cbf5b142a14d
MD5 2b1cdc49c16baf8993a05e7b28098551
SHA1 b189ff0edade53de39edbffef634376410624b17
SHA512 92f3554cecc930fbabc9e93090f531a446a3e731b18e6d79ecb269210cffda5dc62f1c04d14e8f0d6248694704650251b7058cda45090b007734d85674a775bf
SSDEEP 12288:oeBNUbTVO86UMBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dP:oJIUMUeA9n/TM4NZYeNm+9MhUwd
TLSH
T14685CF7BAE38ECE2C27E4DB956918700D77278304B6293CBD165830EDE235E15E7AC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 07f6da754052b7e9dc1eed86275a89fe3784b395cb1bc7f83053950dec298598
MD5 4540345116eea9081f10539763b93e2f
SHA1 9ae935fc795711d8d82d8a28974937d82a267de7
SHA512 346f84f496708bc081fc2fb86a78d096514d07976e54c6f7c5f69e993b68726559c4dbc59c41a94f3e1ab8f713583b5f8bc2bd2365081581d107550a9464bda8
SSDEEP 49152:CQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THW:CQvGAdlCEL8c/yRNw5Csfb9s
TLSH
T124267D656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 1384adcab79bb9cd0e126e59d84475f6f11fed19b34f87f7d7d20529ae5b2955
MD5 2365c15b1593c0283fb451af54cd9cb9
SHA1 c9dbf5ef7656e867d2c288a6c377fcb7af0470fd
SHA512 05381b676eb4848f18d08f1713dff5f4c2f103a3f77ed8453d030af701708b7388347e79e331013a9fc7c18fd511e5194b49d9c14e750d9c1cad3eba5e01bd44
SSDEEP 12288:uAwSfxL/2Dc3SDLLmt0LDQewsAjeBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9V:T7ewsAjeUeA9n/TM4NZYeNm+9MhUwd
TLSH
T15785E031FE74D432C3BF0DB21B36D706586DB9204B511AC3E3A89E9E59302D26776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2e034be5d126024ace6971f7c19d3b2cacb18c7ffa287ddcd0abc92fd35b9a00
MD5 2782ef7ec7c446521dc1e37d20d52586
SHA1 344361153c942a51d2ab313e9bab0ca6abbcc1d8
SHA512 85471c486a5d807fa8e6cf854e1dcd28f63b7313a2a04072c45e2c5ba6c25533f1ea8660de9d3a942dfc5a91e76bce1ab410c2e9a7204648fa4d9d79083dd18c
SSDEEP 196608:nUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH99:nUEtQevvqc2W1cpV2EI32
TLSH
T1D3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0b6a59cda5ddc0d81e1a990545de6247077713f1c780e58694ad04c22b9c7835
MD5 3911f4bea78ca5b4710f16d822ea578b
SHA1 1a399700ee7e638ec0b86c8f931ac871d82c4594
SHA512 0767ed8d1e65d6373c30654e39ce2d9d4d367c1e256e9730fa050df69fe7179e214bb4fd3f73d4cdf00d8886a47516eac2127799c8377e912a3d0461c281ee45
SSDEEP 49152:wCbRquA/m2yL5zTfFiV+XenmE3/zoA9n/TDbXNKd:ZoquVjnmofb9s
TLSH
T149D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0139757ceaef97781060b8dbe8382b1850f3796bf7e3670ca0eb8bc715c7de45
MD5 3460d7fde689d02a9242115ef479d9f9
SHA1 8df1adfd4eb29d2a02290af59a1f4194ad65db4b
SHA512 90a23d7616dda44d30ae096e9de792bc19446c0ab45f9a373d55bc8947f1220d8a293609bb122cfd5b4bdb565a49d74edf4ce34a4443b00ad58e05968bbf68f9
SSDEEP 24576:5AhGLJIFoiwtA5l7S53PUeA9n/TM4NZYeNm+9MhUwd:5AMyFoiq5zA9n/TDbXNKd
TLSH
T1F3359D81EBF945D4F5B3AAB899B69570EA76BCAA5E31C20F1150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 5b6e173e05b7a4921bfb46e1b83e9d63eda0fb9a135ee4635a8dc7e11d0f4472
MD5 85282bb522203ad6c6214e841d999ca7
SHA1 6933c32cbdf3b392d869aa83eb522f90c0926ee1
SHA512 f26965218a9ee2b01154d6a8716d5584d97c3ae2456fb32a53eb50bbc7069b1dd8c92bd5eb2d5e512099c4852c6f11b4f75bd0b33c6da35a8fae6348ab0794fb
SSDEEP 12288:Zmw5HEjsChNzBFgl0WDm+C7BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2df:0wuSOWCUeA9n/TM4NZYeNm+9MhUwd
TLSH
T18185F14637E80CF9DAA746398597D535EBF2BC062A21C71F0760C61B5F37261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 93c675818d386f31fa2b74bce92ab1130da5735e2148eff3bb79c5e85c084883
MD5 55b80d3606992258c1347946bb8de85d
SHA1 a362992455ae215e09d5bab9abe0e708668c4055
SHA512 4ce277dd5845d521e93924446d3b05dfa005e73ad9051e32172dbdbcd02e4a235ba353d0560ea3bf1dd00928b3634f664e9e7e722aca751913b7e7611e7b72de
SSDEEP 12288:hjZ1IyuBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d2:dZuZUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1E575128627F814F5C397467CC8E56B08DBB27C5A677543CF0225626A1F32AC28D3A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e8215c2509b9438e10f78ca7185e3f71f83c27e19377bc02c0f17006071d0668
MD5 a52b5297f1529eff80abb4ec1286178b
SHA1 9ab146e5c26eda8c67a59a41458d8a74ef970baf
SHA512 dd1ef600324798413040ab73a28b1e8c18154180d567c73bc332e7556fe52bbb7851e7a7669d59b856ecb13e4c2b53c0f05b1a10b9cda0b698e856724578faaf
SSDEEP 49152:bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uq:KQRQyi36YOcPQLvw2gAf+PN3jfb9s
TLSH
T1FF666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d12904667134813519adcef2d90f9a6bbd0529d3a28992e6874f4638cf4e50e3
MD5 b7ba8e19bfc41954dc526535eda244d2
SHA1 9b58ef457646665b76e8ee8f09f1b755f3434acd
SHA512 03ff848dabd5b891ef6ed1314e4332b7d187ec454c540fb58fa1001300d84ba4dedea47a8c02e23fefc95212f5def1ce4b7dc5409e3557ef42bc10ca11b77cfc
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uq:QQRQyi36YOcPQLvw2gAf+PN3jfb9s
TLSH
T1D3666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 bdc477eec2708147cfc1565292e27a17f09125e13a648220d6b023237b7af6b0
MD5 d5363573e5d2eb8c4c87716d4c4cfd41
SHA1 6907aae8a89ad509afa5ec61764d46c71fdbb1c7
SHA512 e4e9498be35555a8725a96b17147949fc6a97801af13d0184ed6f8448624ce2c6e97a1a8b6126b7ee52891a1daa1b5dbe242e688334a35d8af547c4def34b6a0
SSDEEP 24576:YwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0JUeA9n/TM4NZYeq:+68Qg55nhheWu7PNU3/4A9n/TDbXNKd
TLSH
T14CB55A33B2F600A9C44DE1769F4A972196D27C758FE0E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 bb79d24e3e17aa3691ee64c4718318cfe8aede6fd0f702fd442f7e0b45972692
MD5 1a02f52ee227e744c28ad70efb0add2f
SHA1 a646cbff01ef2b9edc017dcfc5c670167b131b73
SHA512 ce058ab6580b6638fc6fd595e4ac8cecf97b34c3314fbeb0e5feb8cc25cc3135ea07127d4286a4c8c811b9fba810e7867aa8479f81f047dfd0c28e86ccaf3a36
SSDEEP 49152:C3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk998:Dy5112gYy5azzVvL69nLKnhZyfb9s
TLSH
T1E8167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 74109b3febb8beb85b9b45e27e6c76d2c37786452fb8c1a59498fae63cc31d56
MD5 7b7a92e1f50bea9f3b99bb098ad1f1d0
SHA1 272baad9526e78684ebae67f44c1e5f79f8cd93e
SHA512 8e7561842c6567cbf532668259791fbd5db431eb1d26052e4cadcb01c8be4d8a660f7866f78b1c9b3c48119835d6313026fb8ef62add5900d9e50f83290f4e0c
SSDEEP 49152:LB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glKA9n/TDbXNKd:du6JmVxd2d7fb9s
TLSH
T111D59D13F1D901E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 01868e047849fca41585c506ba321e20ab7e8996db58cd4214398b43857702e0
MD5 d23c58808fffe4f5783dab2bed82bbeb
SHA1 7261b79b7ed21c3dc01c533b77ca4be15d3c3b78
SHA512 954d5662898e62d5b2a53008b531dbe9ebfd4d54999e45121e2639db3a2478cfd7de48117e456601290eef3fe52b40682c029e97137179c2c62ada2fa05a706f
SSDEEP 49152:41hpsNoJpF1A6UU44CwH7R4xuA9n/TDbXNKd:4mifPbRofb9s
TLSH
T1F2B5BE13F2D800E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3fe5c279bbbdab7a531f50839295cab2a1425a3cb3a387f269e74b915526a1be
MD5 b3512c5d30165660c2ab30fe882d3622
SHA1 73e72c798bc45ba62e1bd968b17aadacd121f677
SHA512 bf499c070ea2df16c1da870bc973d07307cf3e3835387d67c2e79ae12c193808dd628be1dcdc1abeb77e3d225d73309eb6f4f0636728ed1391dfae8c5cf6b011
SSDEEP 49152:4SuZQIY0Be2KRRVtOnks6NMHqlA9n/TDbXNKd:i5dKTi61mfb9s
TLSH
T18AC5BF03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f075be22fa5b37e5dd2968793c7a38ba324d26b2b2eac6579f3cafdefddca47f
MD5 757caefa8807490841e0c09cf21c2816
SHA1 3d5211f508d2bf9fe0ef160634744d98b1138f12
SHA512 16d69475595201f41a0df6e9fb004eb73f1d35be01e657b4b3956b529cb5afcd0b19f22580b51d7e0f384555e98b3fd378da552f851fa65d177e3e35aef6c498
SSDEEP 49152:RhtSn8EApI0figngiDn0AP5waA9n/TDbXNKd:AX2iyphUfb9s
TLSH
T12395BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 2fac5ed0a3f64aea71354fd296ba95a712a9fc07a59471f7d0c8fab8adb51850
MD5 45e7582e92bf7df9f456b0f46d411051
SHA1 e09f1e6fc24270b7b92c12333d014d9375908d8e
SHA512 1b74fd5d9c3c40c81131dabe9e690738fc7f99c7cca18246df4d351978565d01b4aa486f14dc91c9e1a36903fa054ae5dde691cae39d18d9c7c62bc59352b46c
SSDEEP 12288:MFBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d3:MFUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1146523824BFC09F5C74A0AB580A67B0CCD92BE4FF68543AE471E722A5F345C6C9564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 3321701e7cbec80b6353d87d185eaa0642e736ca476e96f4923a5a0158d6b3de
MD5 15423e08497b790c7333e1654131528c
SHA1 880e06af6709152021cf423bbecb79a8fe3447f3
SHA512 caf845ff602f94536ea1c86185c50327bd0b946c3590ae24e54b9fbc3b348324f492fa689ec33c416a19cfd39732b323c9e56d8329accdf9cd7b90959508681e
SSDEEP 12288:maBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dU:maUeA9n/TM4NZYeNm+9MhUwd
TLSH
T13D6523824BFC09F5C74A0AB581A6BB0CCD91BE4FF68543AE470E712A5F385C6C9564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 f6bb4cf5d5aa92345762912de8af03cd27058f480873d9205f194ec5ed5d291d
MD5 617f3157d55b24375c1de4810a8d5457
SHA1 2a6dd55e3aaa7fb7cd182d2815d1b3f18fef79cf
SHA512 15a4b48efe6fefa63610ea08cd5e861190ee18f07694707f34cb8f923db699dea6859796cad6398ec64b0efee78c315a5013b17b329ea7860e3337c77c57ef0e
SSDEEP 12288:qUBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dE:qUUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1436523824BFC09F5C74A0AB581A67B0CCDA1BE4FF68543AE470E712A5F385C6C9564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 d129f167295d5eae4b3e188dc9c7944cafb0a82750266345d3dc5fc8beec6150
MD5 191ee7489ae4098003394bea6e3ca966
SHA1 062a1c45592c70a8bd32f0e03fd28e94a6ed288a
SHA512 3a9bb41b470360f08ee87dd697c3414ac23cee0ee8e230c65926d3172106aec14509394856ba8616648a6f0fde229b86b2921487163b92f450c4345e498bed92
SSDEEP 12288:zVvBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dg:hUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1ED6523821BFC04F1CB4A9675C4A6A708DAB2BD4EE76583EF4705361A0F302D5CD35A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 6825a20c6d78426bd68e1f47b9265d6e4ac72e05a9c06fa6b95ddd7a17835f10
MD5 25efb5f796f699086e07df908329287e
SHA1 a5ca260c612ecac6fa8459770381525540d5090b
SHA512 962c6ad39a5638766945f84a4f0f6f01dab497ce3f95d2fc120fde233c9f5e255ec46c0a0cb2fe4445cc868a0ac3ad27ab0ea78578295f2018a7e3b823108d1d
SSDEEP 12288:JHBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2db:JHUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1686523824BFC09F5C7490AB580A67B0CCD92BE4FF68543AE470E722A5F385D6C9564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 d792a2b73102205461f7d6639f3a8c373430a1c5f4d8a44f07c7da1c029f5bc3
MD5 fa90e4c784671d0c01e0701f557b6feb
SHA1 d70ba45236ca6697a3fee2c2693df3bf0c2b8d85
SHA512 98f66c3a4e795c047e5aa16aa2bd443d049d19c044e6a0beb6ae4d75387d9e143c0519cc9ae44123ca33827589f5a726325282369fbc02590a07af3df2c516bd
SSDEEP 12288:vGBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d1:vGUeA9n/TM4NZYeNm+9MhUwd
TLSH
T14B6523824BFC09F5C74A0AB584A67B0CCD91BE4FF68543AE470E722A5F345D6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 ea15b218d1e4efb427f5f58649fae1cdcf55b19b99be4f5ace38180ebc047ddb
MD5 153bb6be49653d34a8ace0ffbae151c0
SHA1 e5c8fd1f541cf71a09330e303508b60de7ffdca6
SHA512 fd0ef274542d1c1fac5dbfefd39c90b93ed250a65fb8f3c26877f552e68cb1f866b1c4dc4ba75037f375825a18ac6d1ec8a8c2f8201bf025adac679cdffd44c9
SSDEEP 12288:SyBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dX:SyUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1CA6523824FFC09F5C74A06B581A5BB0CCD91BE4FF68543AE470E722A5B385D6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 a02a01fe5bb6064cac1a1604b42cf376f586187c8a99f54be97c4afd9f0438fa
MD5 9611f6248eccec5866a8297a2ab84c80
SHA1 915932157189d05825f0968c8faf2d94fdb26971
SHA512 c2f984ac33a4b3f80a4b52e856020e5571b867494af485f28f09c39ac2227d8a27fd770525f5fedbb4ae4ff23112278153bd70b5d4c8be1c7c319e2ddad93fed
SSDEEP 24576:fZMEzFVSO6UeA9n/TM4NZYeNm+9MhUwd:fZMEzfAA9n/TDbXNKd
TLSH
T19585029573A00CF4DD67823EC8659A05D6B27C1A5760C75F03A8362B5F333A14D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 6406837576441705de36d214c55c29063b25d815bfe5606b45045459329258cd
MD5 bb311367eb23aebe77eb84d3b11cd9ef
SHA1 7176d4649c39869b562db9026e251d23e90fe374
SHA512 c4423fcf287ef829c66068966662024b44682e1ba8cc06282ca1ca91f1968ef83f6c4f5fe93510afb367c73a45e2eea985926b255c5bf08792f35ca76429ab19
SSDEEP 12288:KpBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2db:KpUeA9n/TM4NZYeNm+9MhUwd
TLSH
T17A6523824BFC09F5C7490AB581A6BB0CCDA1BE4FF685439E470E722A5F385C6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 8fad0805f1db09dd2be1faf5783474896690fcd23cb1ca01fe43dc62e2b814f3
MD5 c17b7ced9ba760911d3995e581096fd3
SHA1 3ac006d6f863a95a029ca4262903ae42025493d7
SHA512 6c1c7202a2f38aa96ccd827756fa9c86be90570a70ceecd423fdac55b54ff168bd9fe30d299a41c77700a43a4f1cc9c103460212d507e792eab65c382d9919e4
SSDEEP 12288:/tBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dr:/tUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1A66523824BFC09F5C74A06B581A5BB0CCDA1BE4FF68543EE470E722A5F385C6C95648E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 93d29915375ce976df5ddac372466d1662590826cada75fcbed7d1c1275918d2
MD5 45cbfd4fac6f6b3cedb277bf1f00768c
SHA1 018fc3ab443cc7ed522589fc58cab4f64dae6b96
SHA512 afebac762c131022ffe5adf356d3b6730de0e1e7e9173826e81015c0a16f248b2896d13f47dc4ec09dc37a6d23c26cbbd6e8b9b229e0792fbc25cb8f6409a166
SSDEEP 12288:SyPz5L8uBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dv:PzyuUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1E675124767B520F9C2674238C8A21B05F772BC3A57208BAF036417762F376D19E3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 051fba545a9f04a59fce102b61ca3422b8df418e84da0b10597eb4f4476c681c
MD5 478ac4e41d50fb38874f88de3198cf82
SHA1 1f5cdc038e41407b0536759ab72e175c2d856ffc
SHA512 ba584773198d2b1daa843d228a42320ba689834ab20fe61ac5ef5eaa643094c5e79b1485d708ec8def6d2033e5a32f14c2700ba7dcbcc9f6f92cc9c22f3ba59a
SSDEEP 12288:QpBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dc:QpUeA9n/TM4NZYeNm+9MhUwd
TLSH
T19C6523824BFC08F5C74A0AB581A67B0CCD91BE4FF68543DE470E722A5F385C6C95648E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 f2ce80af9a50d946f2f312024933a9a8696101f326a657e7a2d203467d5dad1c
MD5 af23405bd97753e62b3e0082f7e2f6a4
SHA1 8c60a367b9ca4504917135fd8b05365ff9cc9f58
SHA512 0a29d44fa2a232297737af99e0d51b16f778577f4e61fa6dee13200ca2131a3380ccc3ebeab0934b44a9bb0a9dfbd725f995ff6e6caf7a214cb2cdac10a0cfb4
SSDEEP 12288:ipBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dL:ipUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1666523824BFC08F5C74A0AB581A67B0CCD91BE4FF685439E470E722A5F385C6C9564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 186da490f394d6ddce22bdc688e30247f45ac23820146af7263508a22851864b
MD5 119f608bc9850b701ffde876210073c9
SHA1 b346cbfe1462e9475e3265357b2a20250e031d65
SHA512 c5274c7d8a0ad0e9e6345fa4f5746aad9504e744776f0fabda4cff617fea455dc5034b150cdacf88c88c8d4a1d2e000e92b15f2c2449a51ad80b860cb8c4d9c0
SSDEEP 12288:wyPz5L8uBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dz:BzyuUeA9n/TM4NZYeNm+9MhUwd
TLSH
T13D75124767B520F9C2674238C8A21B05F772BC3A57208BAF036417762F376D19E3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 883c99fbda27f2a3be52a5efb0cd4310f558e50a27684e8f00d4e498f108ddb5
MD5 c057a8967ecfe9fe4c15c049d9acf354
SHA1 8b60d1711bd149bf5e7829038853890bef881eb4
SHA512 7ac5f9531af61ceedc327334d1604e9caf48e7fb0c1290954b817e5a2630be5d13f9f7307c79fb08f8d0a6013aa31250781f82ac2e350b7b0ce384980b13bbaf
SSDEEP 24576:2TdaLl3z0zDEUeA9n/TM4NZYeNm+9MhUwd:2TwLljfA9n/TDbXNKd
TLSH
T171850295B3A00CF8DD67423EC8659A05D6B27C5A4760C75F03A8362B5F333A14D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 a06e276cbfe254858be81b9bd9b038337683cdbcb588ae153167bd3327307f2e
MD5 b8bb518463eb235039720eecac523b0c
SHA1 13f8813f37127e341e16c129a16aa4c2e0615412
SHA512 c86d0378084fdfab1e0ea1d1fbb670121ae53d6060e2b7611d7d96b0bbebcf089e452cf818527765ccff791d16a98002a16c43a9e750995eab4e5a99f1048939
SSDEEP 24576:A35d9CHKy7GZAUeA9n/TM4NZYeNm+9MhUwd:K5d9CHKyaAA9n/TDbXNKd
TLSH
T19295CF90F3E814E8F1B79A35C9765501DAB67C5A5B31CA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 03b9686be4afb205b2977a86ef36fe16b41a61f0929722788061d83af0ce62b3
MD5 bd3bb403baf24bbf70e25836167528eb
SHA1 2d83420acbd7ef783f6b1f0ca2843e24feb079a2
SHA512 7e9180826608772a2f2da15bcdb54056752bc2ce7d070a6a1dd79ae02821945638c40e5f81d8f221900c1467056d42008313f845fa31d218d19ef9ca21028022
SSDEEP 12288:O0BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d/:O0UeA9n/TM4NZYeNm+9MhUwd
TLSH
T10D6523824BFC09F5C7490AB584A67B0CCDA2BE4FF68543AE470E712A5F385C6C9564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.6MB
SHA256 f10acb995ad91b2cfbf95db7d01a4f9f0b9d86f66ba2c7b0c3d44b51b33de622
MD5 0e5318fe08103505b1e98fcec07d917b
SHA1 b7165fd5b294a3dbe3c4c75f4cdc04032bf8ef01
SHA512 f7a14fd3a79b11cf979b2ee5b4305d0815670ef8927994cc721969f6af443467d485b473301a1ad396c3b11c571e236a6d19b3038c353ec3d7b9a3ae5f6d5fd5
SSDEEP 24576:yuwvik9RX6wkyAI9UeA9n/TM4NZYeNm+9MhUwdyUTDWG6goHD2LwyKTPxEDev7uK:/MnYI5A9n/TDbXNKdDslFyKTmCDu+
TLSH
T1A1D5F129EBEC08E5E1B7923C99A3460AF6B178591B71C3CF029A136D0E37ED45D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 72c81b2c81d37c22a7a58713d764ef616a6552b83ee5983230a25944cbfd3590
MD5 55870beb57980288a75978e92e80d46f
SHA1 6c3604dc97ed6fc01983420f4a98c93e830346da
SHA512 9c36f54c28497e50da092b32ee49487bf014e5261297484b538c7482c061c85f4a02b48ccae658d6b6fdba42bc913d4ab22395f50716efedc8da5a36641e2ab3
SSDEEP 49152:lYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK06A9n/TDbXNKd:lySzPDfb9s
TLSH
T156066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 fecd5e9102456924a47f3bed0dd672126f9deebe78bb4607c572389c87c979ce
MD5 4d3c7ca058942f91a18046783500da44
SHA1 a0da3a5d10244703a17afcc3c1cb5bfdb695c8bf
SHA512 7a84d0832e64a65799877a615cb8f8c05a8b8d543848da7a74381e75208864b9225f1c7779ff007d23ede9b7f1fc26136c9a54ba408edd60d8142af8bfc77020
SSDEEP 24576:S47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYKUeA9n/TM4NZYeNm+9MhUwd:S47JUQj1irIhCnDHUPfF/KA9n/TDbXNs
TLSH
T18B65AE1EA3EC01E5D1BA927885154A1AEA71782E5F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 dc8029b59e350973bf5737de866f811b0a5b11e9abd803a09adbebf161558975
MD5 c0bb5b76682559efa2b190e8a7028e06
SHA1 d6388929c79e35e64dea932550f20fd6bd26e51e
SHA512 2734905214971fd3153e8e69d2ad16370018ea9740193fece0a00dac82818c05e15810d838f97e93b515869efd55c45c8ab38177f2d7fc62589ce17d5e5914a6
SSDEEP 12288:PzsfZBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dV:KZUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1DE75F04AC2A802E8C16E6279C7565A04F7637C2993E1D3CB43D0F53E1F366D09DEAA47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1016KB
SHA256 7769c7854777eb0bd9581c5f5f178ecffa1ea1fcaf365e58d90ce18e4b4005d1
MD5 f7d719411037148e3645e56852a96a88
SHA1 c7c12200cf54fbcf2dad6d8cca1aa55ed15291d7
SHA512 15004da28950d35a4b88e4296dd3768a4d9e1f2b6d4aa8913cbe8c8460cb4e22a87725d47342144b2ec91b1bbbce218be30984bd32720415e00b6d3fce0d8c16
SSDEEP 12288:u0GsU3f1emviXMb19EoYBnz50lTF2Bd7VF6yjYbBK:u0bUP8mYMbcz5yTF277Vb6BK
TLSH
T1342516117626CB4FC6A940321E72D2CCA7707D41FE44AE0373C99B3F9576659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 46e0356e00693650a29b9d13a4b287aa67c8c04bd3305846a1cc741083f8b198
MD5 c4d8b2e530d1d61faf9b83a40bc30bcf
SHA1 6cda54fa2f8bd8724decb73b78c3bba2b4207cd3
SHA512 428b5c8dd262344ffadb79b018ab9104364f38cb677704c4e6b1f5ed3a28503ec30122cfd9f809eddb783f93b85c3604ca7ed91be9e63222e318c836d73b2ae0
SSDEEP 24576:uMbUMbcMbNVVMb+YMb4MbGMbuMbQMbXMb/MbQMbwMbGMbSMNMbqMbmMbpMbiMbeT:uMbUMbcMblMb+YMb4MbGMbuMbQMbXMb9
TLSH
T140650A416537E78FC1FA2032072A5B4CA7A4EC17B7096F1273C9493AD86AB55B0F97C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 2a1e32928f9976968c5416d607037326dfaff96b6de0dbb29c29d0243f733251
MD5 3705b9d220deabff602c52a3184d1961
SHA1 f7d1d7b895984aa078a4ec9669fff672772c6ae9
SHA512 8da71d07e1b31ff6d14c03d5eab4a5bc862fa380b480f53f583a6a57170aef1b689c78665db799c46c873d1a5e07e9eb02cb1ad4ea6d6109e57c1ed5a31f0f84
SSDEEP 12288:rO7xBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dq:mxUeA9n/TM4NZYeNm+9MhUwd
TLSH
T14D6523824BFC0CF1C75E1AB440AAB7089E56BE4DEB4483DF8609722A5E349C6CD7654F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 41237e1cce60a3009b16a98d2594a5d303baaf48d09aeb955ffc6756cf53e9d8
MD5 347af946214e03703bd7812402985125
SHA1 2acf8a37bb43c43b793e3136e1ae8ca4145710ba
SHA512 ca977965a99de9eb1429bad1b8825eccbffbc7443ca6b77a9c3b553c200aa504d0037fcfeb86f93dff11350f8b35c10826ecbf4e1abe6d831d9022b3ac017413
SSDEEP 24576:jgb6bmBIi49WNNFpg1rSvFv7bYbUeA9n/TM4NZYeNm+9MhUwd:jgb4mBIBhGFEA9n/TDbXNKd
TLSH
T1FF65AE1E22EC02F5E1F9D2B8CDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 46962e10a77009c45f6c1750a1d79fb232a8beeb28c3eb458cd7bcf59d61ee33
MD5 33cd1ba39b6919769c1a528ab12e2851
SHA1 53a569d4d90a5864cfc2fafa8247d15223f145e2
SHA512 9514c1e02ad604d53ea6e3723b8fa7f613699645239012989df2ecfe17bad51dea3cb6c6faed55d727066b520a50d1eb7c8bd054368624ea7e06de6c95baddd2
SSDEEP 24576:BGlUTDWG6goHD2LwyKTPxEDev7uvx7S7:BGGslFyKTmCDu+
TLSH
T14D05237915FA34F5D5BA4239E8E081AAF6B03162339453FF47E923346E448E02E3DE85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 e53277963153bfb4a0fd549dcab47403dcee0b4af3f9e3f35fad8eec4c1fc773
MD5 132b1f75ed6bf7e376cd7aca47a65389
SHA1 4ede7574c3361cd9da7204d0ad2c5505c70e1382
SHA512 c8be66190742921e7e63ee8875b95037af3af648c77d761aa72c3298a849581474283afcacf4d4e549826bcd32df57b9eba7f331de8d2f832f82c951e0524dc4
SSDEEP 24576:dG88u8FpJqH1hzria7/m6UeA9n/TM4NZYeNm+9MhUwd:w7ZFPqVoa7/XA9n/TDbXNKd
TLSH
T1EC95016567E401F0C47BD13889824667FAB2B8251364EBDF07AC8B551F23AE54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f82e2da2bfc3a8835a446ab435c1d952e087138fddcef49bf9ed37e1a58f3de6
MD5 fcf3efe3c749deb67c3e399161e8d8bd
SHA1 e4869c51b85694f1b56f5ec5a70cc6db5c273359
SHA512 6b4631d090b3a517c9f2adf4d330605891bc6392f843b6fb1bd6262f4373d14faedd17582c4041af35a51dc26c140f99ea6638ff461f23075190b9e1ec18e6c1
SSDEEP 49152:kBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjwA9n/TDbXNKd:HG05lO43b6fb9s
TLSH
T1EAD5C06A62EC01F9D1BBD17CD9C6460BEBB23815033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 34159cf21fd1b58c766660f1bb2fda08d6c039ef5dcd1fed2ab3895847654914
MD5 b398aa8d79d44f25fc3578c0bc950d8e
SHA1 5be557326766a1828ee7d2202245474b8ae37b44
SHA512 11bab4d8409c374c3d825f41223bf3bb8a5474673241ce2ccb96f91c4f6144223c9fecf8512e3e2800e5ee7f9d4e0a0f3af07cb405e1e9702fd78573339f1928
SSDEEP 24576:3fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnYUeA9n/TM4NZYeNm+9MhUwd:Pa5POZ3+Jt2pasx2+m4A9n/TDbXNKd
TLSH
T16065AF5EA7FC01D5D5B9D17DC583860AE5B1342653319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 420f86b05df3fac12de9e9f5451676e9ee3ec6f72c25d60b5ab6a7ea2c8b290b
MD5 0059b98d1730c6833955dbe141318105
SHA1 4478a7da69a9c721b76f6883b2c314e909458650
SHA512 fb55598b76568761323633085fe89f6a27703bb765c5c86d6bd1903acf7aeca609210c44874fd8051342dbee886e71f6bc2a3c626da39b3c0f46528992fbcda4
SSDEEP 24576:/NcwHdjbyQ4nLC18lb/EOjowL7FkiUeA9n/TM4NZYeNm+9MhUwd:/Nc/zEOVHF3A9n/TDbXNKd
TLSH
T12B858C1623E901E4E5BBE1BE89779646FA717869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 e0c78fcc00e2445235cc24c1740c36cdee6f3dae8c7b160fce21ff0a4c8d8c34
MD5 e9a5aa5e664170d2057327e74f0f8a8b
SHA1 1ceb2d74adca2db5a1e5d036fe2ebcfba7c3feb8
SHA512 25d26ece33f9cd5898922c59907c266f5a6d9b0ab98170a140bf8f110842237098723133da167a1e2cc59231f45e20d22c87ee7a8a51e5a433a4ce7e239f9e07
SSDEEP 24576:V6DIPUTDWG6goHD2LwyKTPxEDev7uvx7S7:V6DIgslFyKTmCDu+
TLSH
T1B025126D237A10F6D1BB803ED5C20156E2B1B172A39256DF07E8867D5E93EC8BD3CA41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 932KB
SHA256 6e88e1df8d86a5c4087e23add2fafe8160a5ef425c7c1943dc64d7ccfb3d31d7
MD5 aa64385e9a1155ddb6c71dcc2581e03d
SHA1 1ed4eef1f70e67d28606791bee0541a5d9f4abc6
SHA512 1ebb44013ef20bccf34d3de26e7810ebf9acf5643746a7588fd5beac99844dcd088e609d7e2e3482e87f74f8e7ddaf5ec971da6be9c8b59337876122b410c175
SSDEEP 24576:ltyOUTDWG6goHD2LwyKTPxEDev7uvx7S7:ltuslFyKTmCDu+
TLSH
T1B115235153B820F6F6BA0238E9A281A8DB747C22379193EF57E1372D2E31BD46C34756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 5e2770f8e1f3abae55f7f683585b339d09a12a7de790c43eb624dde5edbe7766
MD5 8163483a97748747ad5fd6f53d74f07f
SHA1 a65860059834cf501d532623dbd3ef8104a610e8
SHA512 d69c60f13bc7e84bcfd2b57d2bb75a4e7a6a30c5c987c8d320ce4e5ef3939a1a7d4b5d6e32b53c75c70e21a428c77a95554f9ce881132c6c462f95fa46bb26c4
SSDEEP 49152:iDMwBtOmeA9n/TDbXNKdfslFyKTmCDu+:MF/fb9sfamC
TLSH
T15DA5D06EAAF805E4D1FEC675CD238516EA727861133293CB4390C13E1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 b8370a29dfe93fa3d5129350cea202df84f1059da49c08f40bdb001be3ee01d9
MD5 a7a20a9e4cd81d76792a70f599355dad
SHA1 870d68b00d7f79a732c350d00e4463ac207803e3
SHA512 03a2077e77b65596acb74b45e48375c0d11703fa19b9a29b1538a6fc97f178fcf135442885d3b97a28d5e4afa4a553109f37b4162cb222afaf1f3ed0a947cc93
SSDEEP 12288:GHvUrBFrEjwaQWBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dI:GPUr+NQWUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1BD85E11F26EC0CE5E67AA17D8582870DE772B856131292CF0291817E4F37ED8AD3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 a5c5f04adf5b62f920ed57d525c5f49e859e8ec7b3a91c08f7a9dc9a737f9c99
MD5 81c0d6fdec363b7aff4f3c9e31621775
SHA1 2cb093d9302998c5f4c3e2b6047c5c7d25fe326c
SHA512 bcadc87ea814866ab659fdc524b736fe78e6b020e1d4c17863293c9205ffd2491e4b16eee39ac9af25d7f1c5cc1d9d836000b16a21b55f079129cb113edb01e6
SSDEEP 24576:WD3FHshBIYQgAlUeA9n/TM4NZYeNm+9MhUwd:WDVHeBIAAhA9n/TDbXNKd
TLSH
T1FE95E17EE7AC04E4D57BD1BCC6638A06E77138AD032156DB029491BA1F2BEE46D39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a5469dfd25f2ba71.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\a5469dfd25f2ba71.bin
Size 12KB
SHA256 c8be9786cf4a0468528f603492256e5fd52b9105bc5138738184c96324397c12
MD5 592f3c7cc209b540e76d2b4b66984340
SHA1 f2480fc65c2032291ed2443b5772fc866a007086
SHA512 02b5da719422700b094a40343eadad10247204b2b0e7532c79c78f9fda93601210c697ed6a6ce75fcdf380b9b115a4aa7ce962453a7590452df72db425a19581
SSDEEP 192:55s6qK5GzbgqkQMqF21gzGaQmIqnhZjMkC89yFTTT31AtpStL3X76IjyX0Q0:Z6TJVOgyaQmpr7ytTFAtpSxLTjyJ0
TLSH
T1C042D0A10DDD05FB1E823CD000BF6BF40EB58D127CF89A8A85DB479E769A51926023B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 796KB
SHA256 8ad6d15d6ba47aabfb1a277ffc277f6cc4d55d5a5f3cf61e4315e58c9b35d96e
MD5 d3660c0cb7f89a8230a6df2947894a9e
SHA1 3f8b6d7b856227857e94df400f83bbde20835af5
SHA512 b05822fc1117c6a940d18a0129152c2423ae3f60e948461d65e7521ab180f6476cff750dea7d6163c372c29995065754c62df0e50ba8df294c598f6c264987a9
SSDEEP 24576:g0kUTDWG6goHD2LwyKTPxEDev7uvx7S7:gcslFyKTmCDu+
TLSH
T14E0523B145B968F7E6A6023AF8D081ADE7B4721733D993EB47BE23042C44CD42D79396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 940KB
SHA256 a52509000fb72accaec0592a7fa63023cb38fc7e09c5520c2e91d19ea6856356
MD5 9f1a5e9e7606f17a8cc20c4c5bd074e7
SHA1 d3050a05485e38838d938f8c60e131cb6c059110
SHA512 ca3d3b3400d8242694cb0a13e18b7f1e616de907870fe913b4a074e567cd4db0aa7cb79b626afb875af2860d8b978871c0b040baa7c21f6cc7dcbb438700ea17
SSDEEP 24576:76UqjpzUTDWG6goHD2LwyKTPxEDev7uvx7S7:76ULslFyKTmCDu+
TLSH
T15625226E52E424F6E17A4234E9A18169C2B0783323E597FF67E8173A4E31DC45D3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/620-426-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/620-157-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/620-150-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/620-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/624-422-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/624-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/624-111-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/624-424-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/624-105-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1268-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1268-22-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1268-30-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1268-119-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2512-149-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2512-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2512-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2512-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2852-248-0x0000000000400000-0x00000000008E3000-memory.dmp

Download

memory/2852-0-0x0000000000400000-0x00000000008E3000-memory.dmp

Download

memory/2852-7-0x0000000002B00000-0x0000000002B85000-memory.dmp

Download

memory/2852-61-0x0000000000400000-0x00000000008E3000-memory.dmp

Download

memory/2852-1-0x0000000002B00000-0x0000000002B85000-memory.dmp

Download

memory/2852-9-0x0000000002EF0000-0x0000000002F57000-memory.dmp

Download

memory/2852-16-0x0000000002EF0000-0x0000000002F57000-memory.dmp

Download

memory/3188-120-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/3188-425-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/3188-128-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3188-122-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3488-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3488-421-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3488-439-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3488-99-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3488-93-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3488-437-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3568-299-0x0000000140000000-0x0000000140300000-memory.dmp

Download

memory/3568-272-0x0000000004430000-0x0000000004490000-memory.dmp

Download

memory/3568-262-0x0000000003100000-0x0000000003183000-memory.dmp

Download

memory/3568-278-0x0000000004430000-0x0000000004490000-memory.dmp

Download

memory/3568-297-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/3568-295-0x0000000004430000-0x0000000004490000-memory.dmp

Download

memory/3568-253-0x0000000140000000-0x0000000140300000-memory.dmp

Download

memory/3568-292-0x0000000003100000-0x0000000003183000-memory.dmp

Download

memory/3568-269-0x0000000003100000-0x0000000003183000-memory.dmp

Download

memory/3568-260-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/3568-254-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/4480-59-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4480-46-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4480-47-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/4480-53-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/4480-57-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/4580-146-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4580-139-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4580-144-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4580-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4580-133-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4604-68-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4604-69-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4604-62-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4604-379-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5136-420-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5136-85-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5532-398-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5532-75-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5532-81-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5532-73-0x0000000140000000-0x00000001401AB000-memory.dmp

Download